βΌ CVE-2023-41374 βΌ
π Read
via "National Vulnerability Database".
Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.π Read
via "National Vulnerability Database".
βΌ CVE-2023-2163 βΌ
π Read
via "National Vulnerability Database".
Incorrect verifier pruningΓ in BPF in Linux KernelΓ >=5.4Γ leads to unsafecode paths being incorrectly marked as safe, resulting inΓ arbitrary read/write inkernel memory, lateral privilege escalation, and container escape.π Read
via "National Vulnerability Database".
βΌ CVE-2022-47562 βΌ
π Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43619 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43616 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43621 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.π Read
via "National Vulnerability Database".
βΌ CVE-2022-47561 βΌ
π Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.π Read
via "National Vulnerability Database".
βΌ CVE-2023-26144 βΌ
π Read
via "National Vulnerability Database".
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.**Note:** It was not proven that this vulnerability can crash the process.π Read
via "National Vulnerability Database".
βΌ CVE-2022-47560 βΌ
π Read
via "National Vulnerability Database".
** UNSUPPPORTED WHEN ASSIGNED ** The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.π Read
via "National Vulnerability Database".
βΌ CVE-2023-41375 βΌ
π Read
via "National Vulnerability Database".
Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.π Read
via "National Vulnerability Database".
βΌ CVE-2023-43617 βΌ
π Read
via "National Vulnerability Database".
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.π Read
via "National Vulnerability Database".
βΌ CVE-2023-22644 βΌ
π Read
via "National Vulnerability Database".
An Innsertion of Sensitive Information into Log File vulnerability in SUSE SUSE Manager Server Module 4.2 spacewalk-java, SUSE SUSE Manager Server Module 4.3 spacewalk-java causes sensitive information to be logged.This issue affects SUSE Manager Server Module 4.2: before 4.2.50-150300.3.66.5; SUSE Manager Server Module 4.3: before 4.3.58-150400.3.46.4.π Read
via "National Vulnerability Database".
π2
π¦Ώ βHaywireβ Australian IT Skills Market Prompts Logicalis to Add Talent as a Service π¦Ώ
π Read
via "Tech Republic".
IT solutions and managed services provider Logicalis is planning to help skills-deprived Australian CIOs and IT managers get projects done with a new plug-and-play Talent Services offering.π Read
via "Tech Republic".
TechRepublic
'Haywire' Australian IT Skills Market Prompts Logicalis to Add Talent as a Service
IT solutions and MSP Logicalis plans to help skills-deprived Australian CIOs and IT managers with a new plug-and-play Talent Services offering.
βΌ CVE-2023-5084 βΌ
π Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.π Read
via "National Vulnerability Database".
βΌ CVE-2022-45447 βΌ
π Read
via "National Vulnerability Database".
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The Γ’β¬ΕfΓ’β¬οΏ½ parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists.π Read
via "National Vulnerability Database".
βΌ CVE-2023-4853 βΌ
π Read
via "National Vulnerability Database".
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.π Read
via "National Vulnerability Database".
βΌ CVE-2023-34047 βΌ
π Read
via "National Vulnerability Database".
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptionsΓ instance when registering batch loader functions through DefaultBatchLoaderRegistry.π Read
via "National Vulnerability Database".
π΄ Pro-Iranian Attackers Target Israeli Railroad Network π΄
π Read
via "Dark Reading".
The group known as "Cyber Avengers" has targeted other Israeli services in the past and often publishes technical details of its hits.π Read
via "Dark Reading".
Dark Reading
Pro-Iranian Attackers Claim to Target Israeli Railroad Network
The veracity of claims by the group known as "Cyber Avengers" has been called into question, as it continues to take credit for hits on various Israeli services.
π΄ Changing Role of the CISO: A Holistic Approach Drives the Future π΄
π Read
via "Dark Reading".
The CISO's role has grown far beyond supervising Patch Tuesday to focus on prevention and response and to cover people, processes, and technology. π Read
via "Dark Reading".
Dark Reading
Changing Role of the CISO: A Holistic Approach Drives the Future
The CISO's role has grown far beyond supervising Patch Tuesday to focus on prevention and response and to cover people, processes, and technology.
π΄ 'Culturestreak' Malware Lurks Inside GitLab Python Package π΄
π Read
via "Dark Reading".
The GitLab code hijacks computer resources to mine Dero cryptocurrency as part of a larger cryptomining operation.π Read
via "Dark Reading".
Dark Reading
'Culturestreak' Malware Lurks Inside GitLab Python Package
The GitLab code hijacks computer resources to mine Dero cryptocurrency as part of a larger cryptomining operation.
βΌ CVE-2023-4236 βΌ
π Read
via "National Vulnerability Database".
A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load.This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.π Read
via "National Vulnerability Database".